CVE-2024-2950

Executive Summary

CVE-2024-2950 is an information exposure vulnerability in the BoldGrid Easy SEO – Simple and Effective SEO WordPress plugin, affecting all versions up to and including 1.6.14. The flaw allows unauthenticated attackers to view the first 130 characters of password-protected posts via the og:description meta tag. This can leak sensitive content from restricted posts, such as draft titles or excerpts, without authentication. The vulnerability has a CVSS score of 5.3 (Medium) and a low EPSS score of 0.0%, indicating limited active exploitation. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for updates. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (partial disclosure of first 130 characters)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the low complexity and no authentication requirement, but the impact is limited to partial information disclosure.

Deep Dive & Mechanics

The vulnerability resides in the BoldGrid Easy SEO plugin's handling of Open Graph meta tags. When generating the og:description for a post, the plugin fails to check if the post is password-protected. As a result, the first 130 characters of the post content are exposed in the HTML source, even to unauthenticated users. This occurs because the plugin extracts the description from the post excerpt or content without verifying access permissions.

The affected code likely resides in the plugin's SEO meta generation functions, where wp_trim_words or similar functions are used to truncate content for the description. The missing permission check allows attackers to scrape this meta information from any post, including drafts or private content.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.6.14):

// In boldgrid-easy-seo.php or similar
function get_og_description($post_id) {
    $post = get_post($post_id);
    $description = $post->post_excerpt ?: $post->post_content;
    return wp_trim_words($description, 130);
}

This code does not check if the post is password-protected before generating the description.

Patched Code (Hypothetical):

function get_og_description($post_id) {
    $post = get_post($post_id);
    if (post_password_required($post)) {
        return '';
    }
    $description = $post->post_excerpt ?: $post->post_content;
    return wp_trim_words($description, 130);
}

The patch adds a post_password_required() check to return an empty string for protected posts.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can simply view the HTML source of any WordPress page and extract the og:description meta tag. For example:

curl -s "https://target.com/password-protected-post/" | grep -oP 'property="og:description" content="[^"]*"'

This will reveal the first 130 characters of the protected post. No authentication or special tools are required.

Blue Team

To detect exploitation attempts, monitor for unusual access patterns to password-protected posts. Use the following detection rules:

Sigma Rule:

title: Detection of CVE-2024-2950 Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to extract og:description from password-protected posts
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-stem: '/*'
        sc-status: 200
        cs-uri-query: '*password-protected*'
    condition: selection
falsepositives:
    - Legitimate SEO crawlers
level: medium

Suricata Rule:

alert http any any -> any any (msg:"CVE-2024-2950 - og:description extraction attempt"; flow:to_server,established; content:"og:description"; http_header; content:"password-protected"; http_uri; sid:1000001; rev:1;)

Indicators of Compromise (IOCs)

• Network: HTTP requests to password-protected posts with og:description in the response
• File: Presence of boldgrid-easy-seo plugin version <= 1.6.14
• Log: Repeated 200 responses for password-protected post URIs from unauthenticated IPs

Detection Engineering

YARA Rule

rule CVE_2024_2950_Info_Leak {
    meta:
        description = "Detects BoldGrid Easy SEO plugin vulnerable to CVE-2024-2950"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $plugin_path = "boldgrid-easy-seo" nocase
        $version = "Version: 1.6.14" nocase
    condition:
        $plugin_path and $version
}

Sigma Rule

title: CVE-2024-2950 - Information Exposure via og:description
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to password-protected posts with og:description exposure
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        sc-status: 200
        cs-uri-stem: '/*'
        cs-uri-query: '*password*'
    condition: selection
falsepositives:
    - Legitimate crawlers
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2950 - og:description leak"; flow:to_server,established; content:"og:description"; http_header; content:"password"; http_uri; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the BoldGrid Easy SEO plugin until a patch is available.
2. Workaround: Add a custom filter to override the og:description for password-protected posts:

   add_filter('boldgrid_easy_seo_og_description', function($description, $post_id) {
       if (post_password_required($post_id)) {
           return '';
       }
       return $description;
   }, 10, 2);
   

3. Long-term: Monitor the plugin repository for an official update (version > 1.6.14) and apply it promptly.
4. Detection: Implement the provided Sigma and Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers